3

Our company was recently acquired, and I've been tasked to verify that our software is compliant with respect to open source licenses.

Specifically, I have been asked to obtain from software vendors that we purchased libraries from, a document that verifies the purchased software does not contain open source software (OSS) which, by being sold as closed-source, might violate its original license.

I am a software developer (not a lawyer), but am familiar with the various licenses that OSS can be distributed under. I am familiar with checking OSS licenses before bundling or embedding it with our own commercial software, however I've not previously been required to question vendors of commercially-licensed software.

Is there a particular document that I should be asking for? If so, what is the proper way to refer to it without having to explain the above? I am not looking for legal advice, but instead asking if there's a common name for this procedure (or if this is even commonly done at all).

Improve this question
4
  • 2
    So basically you want vendors to certify that they were actually allowed to license you the code that they originally licensed to you?? By the way, if you have the code, wouldn't it be better to look at the software yourself? At minimum you could look around and see if it contains any "GPL License" notices (or licenses that may be incompatible with your software license) or if it contains code from known GPL-licensed projects and maybe ask about those if you have doubts. – Brandin Apr 20 '15 at 21:36
  • 2
    @Brandin It seems a little crazy to me, too. Most of our commercially licensed libraries do not include source code, so I don't have a way to look at the code. AFAIK if we are suspected of embedding source code that violates a license, and it is contained fully within a product we purchased in good faith, the burden falls on that vendor. I expect our new parent company is perhaps a bit excessively proactive in this regard. – JYelton Apr 20 '15 at 21:53
  • 3
    probably best to get help from your legal department to see what kind of certification statement would be appropriate to satisfy all parties (the vendors, and your management that's asking for this "certification that the software you licensed to us was licensed properly" statement) – Brandin Apr 20 '15 at 22:10
  • ´@JYelton: there is nothing crazy about making sure your third party vendors will be able to support the software they sell to you for the next few years, without becoming subject of a lawsuit because they made a licence breach. – Doc Brown Apr 21 '15 at 6:40
1

The task of ensuring that your software is compliant with open source licenses is not unrealistic, nor is ensuring that your vendors also comply with appropriate open source licenses.

The first layer of defense would be a software composition analysis tool. There are several options - Black Duck, FOSSA, and WhiteSource are three examples of what is available. These tools will scan your dependencies and report on security (CVEs) and license concerns.

However, this doesn't fully solve the problem. Especially in the case where your vendors are providing closed-source libraries, you can't be sure what is included in them in all cases. This is where you would need to have robust vendor management processes. When choosing a vendor, you would need to somehow select one over another. Understanding how they manage they ensure compliance with open source licenses as well as manage their closed-source vendors would be entirely in scope for your vendor management process.

There's no standard document to ask for. However, performing vendor assessments and perhaps even auditing your suppliers to ensure that they are capable of meeting your needs is not out of the question. Depending on the vendor, they may undergo various third-party audits and assessments that may cover their vendor management processes and can produce reports for you.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.